An Indian man hacked the website of a local Indian airline; To find his lost bag, after the company refused to help him track the other traveler in order to recover his lost bag, according to the BBC website , Thursday, March 31, 2022.
Nandan Kokar, 28, said he called IndyGo, a low-cost domestic airline, after discovering he had swapped his bag for another passenger on the same flight.
But after an airline refused to help him track the other passenger, Kokar said he was able to get information about him from the airline's website. The company told the BBC, "There was no breach of the site at any time."
While Kumar said he was "not a professional pirate, but had to 'do something' to get his bag back. In a series of tweets, Kumar, who is a software engineer, said that during the time it took him to get to the baggage belt, another passenger pulled his bag." And he left the airport.
The Indian man explained to the BBC that he only discovered this error after he got home, because the two bags seemed to be exactly the same.
Kumar was able to identify the other passenger's "Passenger Name Registration Number" (PNR) on his bag, and when he contacted an airline asking for information about him, the airline refused to help, citing data protection and privacy laws.
IndyGo said: "The customer assistance team followed instructions not to share traveler data with another traveler, which is in line with our data privacy policies," according to a statement sent to the BBC.
While Kokar said, "The company's customer assistance officer told me that he will come back to me when the company can reach the other passenger." And the company continued in its statement: “The customer service team made attempts to facilitate the exchange of baggage, but it could not be completed as the calls were not answered.”
The next morning, Kumar said he decided to "take control" and began searching the company's website using his PNR, hoping to find an address or phone number.
Tried different methods, using the check-in details, by making adjustments to the reservation and updating his contact details, but none of them worked.
"After all the failed attempts, my developer instinct kicked in and I hit the F12 key on my keyboard, then I opened the developer console for the company's website to check the network logs," Kumar said.
What he found was surprising, as he found his companion's phone number, and added, "To be honest, I only looked for a phone number or an email. Basically anything I could use to call to retrieve my bag."
However, he says the system data should have been encrypted, adding that it allows anyone to access private information. "It's very easy to get the passenger name registration number, the last name," Kumar said.
There are people who share their boarding passes. Anyone can see your bags and take a picture and use it later to get your information."
But it all ended well for Mr. Kumar and his bag, he called the other passenger, on the number he had obtained from the system records, and the two met to exchange their luggage.